Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Configure monitoring for incoming and outgoing file and program activity

This integer registry value determines which direction of file and program activity Microsoft Defender Antivirus monitors on NTFS volumes as part of real-time protection:

since 0.9.8.11

Purpose

Show registry keys (1)
  • HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection\RealtimeScanDirection

This integer registry value determines which direction of file and program activity Microsoft Defender Antivirus monitors on NTFS volumes as part of real-time protection:

  • 0: Monitor incoming and outgoing files (bidirectional; default behavior)
  • 1: Monitor incoming files only
  • 2: Monitor outgoing files only

If the value is absent or contains any other number, Defender resolves the setting to the bidirectional default (0). The setting does not independently enable or disable Microsoft Defender Antivirus or real-time protection. It limits the scan direction within file and program activity monitoring.

Notes

Security

Values 1 and 2 provide less real-time monitoring coverage than bidirectional scanning. File activity in the omitted direction is not inspected by this direction-specific real-time scan. Consequently, malicious or already infected files can pass through that transfer direction without the corresponding inspection.

Selecting one direction does not disable every other Microsoft Defender Antivirus protection or scanning capability. It does, however, create a specific coverage gap compared with bidirectional real-time scanning.

Possible side effects

On servers that process large volumes of file transfers, monitoring only one direction can reduce the processing overhead caused by real-time scanning. Any performance benefit is accompanied by reduced monitoring coverage and depends on the server role and workload.

Notes

The selected scan direction is honored only on NTFS volumes. On volumes that use another file-system type, Microsoft Defender Antivirus performs full monitoring of file and program activity regardless of this value.

“Incoming” and “outgoing” refer to the direction of file activity on the volume. This setting is not a filter for general network traffic.

The setting has an effect only when real-time monitoring and file and program activity monitoring are active through their respective Defender settings.

Microsoft documentation

Microsoft Learn: Defender Policy CSP – RealTimeScanDirection

Microsoft Learn: Enable and configure Microsoft Defender Antivirus always-on protection

See also